Machine learning (ML) is frequently used to identify malicious traffic flows on a network. However, the requirement of complex preprocessing of network data to extract features or attributes of interest before applying the ML models restricts their use to offline analysis of previously captured network traffic to identify attacks that have already occurred. This paper applies machine learning analysis for network security with low preprocessing overhead. Raw network data are converted directly into bitmap files and processed through a Two-Dimensional Convolutional Neural Network (2D-CNN) model to identify malicious traffic. The model has high accuracy in detecting various malicious traffic flows, even zero-day attacks, based on testing with three open-source network traffic datasets. The overhead of preprocessing the network data before applying the 2D-CNN model is very low, making it suitable for on-the-fly network traffic analysis for malicious traffic flows.

There are numerous methods of identifying network-based attacks using machine learning, but processing complexity often constrains it to analyses of previously captured traffic to retroactively identify attacks. This paper investigates machine learning for early detection of attacks in progress with minimal preprocessing. We transform raw network data directly into formats suitable for processing with several machine learning and deep learning models including Random Forest and two-dimensional Convolutional Neural Networks. Many of these models demonstrate high accuracy in detecting a mixture of mostly DoS- and botnet-related types of network-based attacks in five open-source traffic datasets containing packet captures from testbed-generated traffic. We compare our results in post-mortem packet trace analysis to prior works which also analyze these datasets. We compare the features, limitations, complexity, and accuracy of our models to those of prior works. When trained and tested on the same datasets, most models performed very well (>95% accuracy) with Random Forest being the best. We also investigated training time required and testing throughput, and the RF consistently outperformed the other five models.